A flaw in Frappe’s input sanitisation allowed the execution of SELECT INTO OUTFILE statements when the check_safe_sql_query function was used. The vulnerability is a classic SQL injection (CWE‑89) that, if exploited, could let an attacker write files to the database server’s filesystem, enabling data exfiltration, creation of arbitrary files, or compromise of system integrity. The impact level is limited to environments where the application runs with MySQL users that have FILE privileges.

The issue affects all self‑hosted installations of Frappe using releases older than 16.18.3 or 15.108.0. These versions are identified under the vendor identifier frappe:frappe; any deployment of those older releases is susceptible, while newer releases have the flaw corrected.

The published CVSS score of 2.3 indicates low overall risk, and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score of <1% indicates a very low probability of exploitation in practice. Based on the description, it is inferred that the exploitation requires a database account with FILE privileges and the application to accept unsanitised SQL input. The attack vector is therefore a local SQL injection that leverages database permission misconfiguration in self‑hosted deployments.